@axiom-lattice/gateway 4.10.1 → 4.10.2

package/dist/chunk-GXZFO3VU.mjs

@@ -0,0 +1,42 @@
+// src/services/open/openRateLimiter.ts
+var OpenRateLimiter = class {
+  constructor(options = {}) {
+    this.buckets = /* @__PURE__ */ new Map();
+    this.defaultPerMinute = options.defaultPerMinute ?? 6e4;
+    this.agentPerMinute = options.agentPerMinute ?? 2e3;
+  }
+  bucketClass(domain) {
+    return domain === "agent" ? "agent" : "default";
+  }
+  limitFor(domain) {
+    return domain === "agent" ? this.agentPerMinute : this.defaultPerMinute;
+  }
+  /** Consume one token; denied calls report how long to wait. */
+  check(credentialId, domain) {
+    const limit = this.limitFor(domain);
+    const key = `${this.bucketClass(domain)}:${credentialId}`;
+    const now = Date.now();
+    const bucket = this.buckets.get(key) ?? { tokens: limit, updatedAt: now };
+    const refillPerMs = limit / 6e4;
+    const elapsed = now - bucket.updatedAt;
+    bucket.tokens = Math.min(limit, bucket.tokens + elapsed * refillPerMs);
+    bucket.updatedAt = now;
+    if (bucket.tokens >= 1) {
+      bucket.tokens -= 1;
+      this.buckets.set(key, bucket);
+      return { allowed: true };
+    }
+    this.buckets.set(key, bucket);
+    const deficit = 1 - bucket.tokens;
+    return { allowed: false, retryAfterMs: Math.ceil(deficit / refillPerMs) };
+  }
+  /** Test helper. */
+  reset() {
+    this.buckets.clear();
+  }
+};
+
+export {
+  OpenRateLimiter
+};
+//# sourceMappingURL=chunk-GXZFO3VU.mjs.map

package/dist/chunk-GXZFO3VU.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/open/openRateLimiter.ts"],"sourcesContent":["/**\n * In-memory per-credential rate limiter (token bucket). The agent domain gets\n * a stricter bucket because each call consumes LLM budget.\n *\n * Process-local by design (V1 single-gateway); a distributed limiter is V2.\n */\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  retryAfterMs?: number;\n}\n\ninterface Bucket {\n  tokens: number;\n  updatedAt: number;\n}\n\nexport interface OpenRateLimiterOptions {\n  /** Default requests per minute per credential. */\n  defaultPerMinute?: number;\n  /** Stricter limit for the agent domain. */\n  agentPerMinute?: number;\n}\n\nexport class OpenRateLimiter {\n  private readonly buckets = new Map<string, Bucket>();\n  private readonly defaultPerMinute: number;\n  private readonly agentPerMinute: number;\n\n  constructor(options: OpenRateLimiterOptions = {}) {\n    this.defaultPerMinute = options.defaultPerMinute ?? 60000;\n    this.agentPerMinute = options.agentPerMinute ?? 2000;\n  }\n\n  private bucketClass(domain: string): string {\n    return domain === \"agent\" ? \"agent\" : \"default\";\n  }\n\n  private limitFor(domain: string): number {\n    return domain === \"agent\" ? this.agentPerMinute : this.defaultPerMinute;\n  }\n\n  /** Consume one token; denied calls report how long to wait. */\n  check(credentialId: string, domain: string): RateLimitDecision {\n    const limit = this.limitFor(domain);\n    const key = `${this.bucketClass(domain)}:${credentialId}`;\n    const now = Date.now();\n    const bucket = this.buckets.get(key) ?? { tokens: limit, updatedAt: now };\n\n    const refillPerMs = limit / 60_000;\n    const elapsed = now - bucket.updatedAt;\n    bucket.tokens = Math.min(limit, bucket.tokens + elapsed * refillPerMs);\n    bucket.updatedAt = now;\n\n    if (bucket.tokens >= 1) {\n      bucket.tokens -= 1;\n      this.buckets.set(key, bucket);\n      return { allowed: true };\n    }\n\n    this.buckets.set(key, bucket);\n    const deficit = 1 - bucket.tokens;\n    return { allowed: false, retryAfterMs: Math.ceil(deficit / refillPerMs) };\n  }\n\n  /** Test helper. */\n  reset(): void {\n    this.buckets.clear();\n  }\n}\n"],"mappings":";AAwBO,IAAM,kBAAN,MAAsB;AAAA,EAK3B,YAAY,UAAkC,CAAC,GAAG;AAJlD,SAAiB,UAAU,oBAAI,IAAoB;AAKjD,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,iBAAiB,QAAQ,kBAAkB;AAAA,EAClD;AAAA,EAEQ,YAAY,QAAwB;AAC1C,WAAO,WAAW,UAAU,UAAU;AAAA,EACxC;AAAA,EAEQ,SAAS,QAAwB;AACvC,WAAO,WAAW,UAAU,KAAK,iBAAiB,KAAK;AAAA,EACzD;AAAA;AAAA,EAGA,MAAM,cAAsB,QAAmC;AAC7D,UAAM,QAAQ,KAAK,SAAS,MAAM;AAClC,UAAM,MAAM,GAAG,KAAK,YAAY,MAAM,CAAC,IAAI,YAAY;AACvD,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,SAAS,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,QAAQ,OAAO,WAAW,IAAI;AAExE,UAAM,cAAc,QAAQ;AAC5B,UAAM,UAAU,MAAM,OAAO;AAC7B,WAAO,SAAS,KAAK,IAAI,OAAO,OAAO,SAAS,UAAU,WAAW;AACrE,WAAO,YAAY;AAEnB,QAAI,OAAO,UAAU,GAAG;AACtB,aAAO,UAAU;AACjB,WAAK,QAAQ,IAAI,KAAK,MAAM;AAC5B,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAEA,SAAK,QAAQ,IAAI,KAAK,MAAM;AAC5B,UAAM,UAAU,IAAI,OAAO;AAC3B,WAAO,EAAE,SAAS,OAAO,cAAc,KAAK,KAAK,UAAU,WAAW,EAAE;AAAA,EAC1E;AAAA;AAAA,EAGA,QAAc;AACZ,SAAK,QAAQ,MAAM;AAAA,EACrB;AACF;","names":[]}

package/dist/index.d.mts

@@ -175,6 +175,20 @@ declare class MessageRouter {
  * thin HTTP shell.
  */
 
+/**
+ * A model the deployment registered for execution, as the registry holds it.
+ *
+ * The config travels with the key because the catalog needs it: a bare key is
+ * not something to offer a user. `GET /api/models` used to call
+ * `lattice.client.getConfig()` for exactly this — the deployment's display
+ * name, and the upstream model it names. Handing back keys alone left catalog
+ * entries with nothing to render, so the deployment's `default` alias showed up
+ * as a row literally labelled `default`.
+ */
+interface RegisteredModel {
+    modelKey: string;
+    config: LLMConfig;
+}
 /** Narrow persistence and registry dependencies of the service. */
 interface ModelProviderServiceDeps {
     providerStore: ModelProviderStore;
@@ -183,7 +197,7 @@ interface ModelProviderServiceDeps {
         register(tenantId: string, modelKey: string, config: LLMConfig): void;
         has(tenantId: string, modelKey: string): boolean;
         remove(tenantId: string, modelKey: string): boolean;
-        listRegistered(tenantId: string): string[];
+        listRegistered(tenantId: string): RegisteredModel[];
         /**
          * Drop the registry's cached "this tenant has no default model" answer.
          *

package/dist/index.d.ts

@@ -175,6 +175,20 @@ declare class MessageRouter {
  * thin HTTP shell.
  */
 
+/**
+ * A model the deployment registered for execution, as the registry holds it.
+ *
+ * The config travels with the key because the catalog needs it: a bare key is
+ * not something to offer a user. `GET /api/models` used to call
+ * `lattice.client.getConfig()` for exactly this — the deployment's display
+ * name, and the upstream model it names. Handing back keys alone left catalog
+ * entries with nothing to render, so the deployment's `default` alias showed up
+ * as a row literally labelled `default`.
+ */
+interface RegisteredModel {
+    modelKey: string;
+    config: LLMConfig;
+}
 /** Narrow persistence and registry dependencies of the service. */
 interface ModelProviderServiceDeps {
     providerStore: ModelProviderStore;
@@ -183,7 +197,7 @@ interface ModelProviderServiceDeps {
         register(tenantId: string, modelKey: string, config: LLMConfig): void;
         has(tenantId: string, modelKey: string): boolean;
         remove(tenantId: string, modelKey: string): boolean;
-        listRegistered(tenantId: string): string[];
+        listRegistered(tenantId: string): RegisteredModel[];
         /**
          * Drop the registry's cached "this tenant has no default model" answer.
          *

package/dist/index.js

@@ -3540,6 +3540,10 @@ var init_openAuditService = __esm({
 });
 
 // src/services/open/openRateLimiter.ts
+var openRateLimiter_exports = {};
+__export(openRateLimiter_exports, {
+  OpenRateLimiter: () => OpenRateLimiter
+});
 var OpenRateLimiter;
 var init_openRateLimiter = __esm({
   "src/services/open/openRateLimiter.ts"() {
@@ -3547,8 +3551,8 @@ var init_openRateLimiter = __esm({
     OpenRateLimiter = class {
       constructor(options = {}) {
         this.buckets = /* @__PURE__ */ new Map();
-        this.defaultPerMinute = options.defaultPerMinute ?? 60;
-        this.agentPerMinute = options.agentPerMinute ?? 10;
+        this.defaultPerMinute = options.defaultPerMinute ?? 6e4;
+        this.agentPerMinute = options.agentPerMinute ?? 2e3;
       }
       bucketClass(domain) {
         return domain === "agent" ? "agent" : "default";
@@ -21846,11 +21850,16 @@ var ModelProviderService = class {
       )
     }));
     if (models.length === 0) {
-      for (const modelKey2 of this.deps.registry.listRegistered(
+      for (const { modelKey: modelKey2, config } of this.deps.registry.listRegistered(
         PHASE1_REGISTRY_TENANT
       )) {
         models.push({
           modelKey: modelKey2,
+          // Carry the registered config's name, the way `GET /api/models` did.
+          // Without it these rows have nothing to render but the registry key —
+          // which is how the deployment's `default` alias came to be offered as
+          // a model literally called "default".
+          displayName: config.displayName || config.model || modelKey2,
           providerId: "",
           providerName: "registered",
           source: "registered",
@@ -21914,7 +21923,7 @@ var ModelProviderService = class {
     const provider = await this.deps.providerStore.getProviderById(tenantId, providerId2);
     if (!provider) {
       const prefix = `${providerId2}/`;
-      for (const modelKey2 of this.deps.registry.listRegistered(tenantId)) {
+      for (const { modelKey: modelKey2 } of this.deps.registry.listRegistered(tenantId)) {
         if (modelKey2.startsWith(prefix)) {
           this.deps.registry.remove(tenantId, modelKey2);
         }
@@ -21923,7 +21932,7 @@ var ModelProviderService = class {
     }
     const models = await this.deps.providerStore.listModels(tenantId, providerId2);
     const current = new Set(models.map((model) => (0, import_protocols16.toModelKey)(providerId2, model.modelId)));
-    for (const modelKey2 of this.deps.registry.listRegistered(tenantId)) {
+    for (const { modelKey: modelKey2 } of this.deps.registry.listRegistered(tenantId)) {
       if (modelKey2.startsWith(`${providerId2}/`) && !current.has(modelKey2)) {
         this.deps.registry.remove(tenantId, modelKey2);
       }
@@ -28909,7 +28918,15 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       register: (tenantId, modelKey2, config) => import_core57.modelLatticeManager.registerLatticeWithTenant(tenantId, modelKey2, config),
       has: (tenantId, modelKey2) => import_core57.modelLatticeManager.hasLatticeWithTenant(tenantId, modelKey2),
       remove: (tenantId, modelKey2) => import_core57.modelLatticeManager.removeLatticeWithTenant(tenantId, modelKey2),
-      listRegistered: (tenantId) => import_core57.modelLatticeManager.getLatticeKeysByTenant(tenantId),
+      listRegistered: (tenantId) => (
+        // The config comes along so the catalog can name these rows: a bare
+        // registry key is not something to offer a user. Same call the legacy
+        // `GET /api/models` made.
+        import_core57.modelLatticeManager.getAllLatticesByTenant(tenantId).map((lattice) => ({
+          modelKey: lattice.key,
+          config: lattice.client.getConfig()
+        }))
+      ),
       forgetTenantDefaultMiss: (tenantId) => import_core57.modelLatticeManager.forgetTenantDefaultMiss(tenantId)
     },
     onChanged: (tenantId, providerId2) => broadcastModelProviderChanged(tenantId, providerId2)
@@ -33628,6 +33645,7 @@ var start = async (config) => {
       const { registerOpenAuditRoutes: registerOpenAuditRoutes2 } = await Promise.resolve().then(() => (init_open_audit(), open_audit_exports));
       const { registerOpenExposureRoutes: registerOpenExposureRoutes2 } = await Promise.resolve().then(() => (init_open_exposure(), open_exposure_exports));
       const { openLattice: openLattice2 } = await Promise.resolve().then(() => (init_openLattice(), openLattice_exports));
+      const { OpenRateLimiter: OpenRateLimiter2 } = await Promise.resolve().then(() => (init_openRateLimiter(), openRateLimiter_exports));
       const { createKbProvider: createKbProvider2 } = await Promise.resolve().then(() => (init_kbProvider(), kbProvider_exports));
       const { createOpenSandboxProvider: createOpenSandboxProvider2 } = await Promise.resolve().then(() => (init_sandboxProvider(), sandboxProvider_exports));
       const { createAgentProvider: createAgentProvider2 } = await Promise.resolve().then(() => (init_agentProvider(), agentProvider_exports));
@@ -33647,7 +33665,18 @@ var start = async (config) => {
         })
       );
       await registerExposedPluginTools2();
-      registerOpenRoutes2(app);
+      const openRateLimitPerMinute = Number(
+        process.env.OPEN_RATE_LIMIT_PER_MINUTE
+      );
+      const openAgentRateLimitPerMinute = Number(
+        process.env.OPEN_AGENT_RATE_LIMIT_PER_MINUTE
+      );
+      registerOpenRoutes2(app, {
+        rateLimiter: new OpenRateLimiter2({
+          ...Number.isFinite(openRateLimitPerMinute) && openRateLimitPerMinute > 0 ? { defaultPerMinute: openRateLimitPerMinute } : {},
+          ...Number.isFinite(openAgentRateLimitPerMinute) && openAgentRateLimitPerMinute > 0 ? { agentPerMinute: openAgentRateLimitPerMinute } : {}
+        })
+      });
       registerOpenSessionRoutes2(app);
       registerOpenCatalogRoutes2(app);
       registerOpenFilesRoutes2(app);